Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Bruce Schneier on Security Metrics that Matter

“I like to measure the performance of the team,” said Bruce Schneier (@schneierblog), CTO of Resilient Systems, Inc., in our conversation at the 2015 Black Hat Conference in Las Vegas. “I like to see metrics about people, about process, about technology. There isn’t one metric that works since it’s such a complicated and moving target … Right now companies have to use the data that they have to figure out if their teams are effective.”

Schneier feels that certain metrics, such as blocked attacks, don’t really provide a gauge of how secure you are.

“Metrics can tell any story. Question is what story do you pull out of the data? Right now my worry is there’s too much data, too many metrics. You can say anything,” said Schneier. “But really, you’re making up a story with the data.”

What you really need to do is measure the team’s performance. How are they doing?

“If you can measure when and if your team responds and how they respond and how they react and how fast they close serious incidents then maybe you have something,” said Schneier who realizes that a lot of current metrics aren’t that useful. “How do you measure how effective you’d be against a Sony-like attack? You kinda can’t.”

Here at Tenable we try to help security teams explain to the business their current state of security. It’s a hard thing to define, and it’s even harder to communicate.

“There aren’t any really good pithy ways for the CISO to tell the board we’re doing OK, we’re not doing OK. It’s going to be gut. You’re going to stories instead of data,” said Schneier. “But there is this disconnect because it’s such a technical topic and the board really wants a soundbite.”

Assurance Report Cards™ (ARCs) are Tenable’s answer to bridging the communication gap. ARCs are available in SecurityCenter™ 5.0 and display an enterprise’s security posture in the familiar format of a report card. They measure and visually communicate the status of an organization's most critical security controls.

Future of endpoint security

I shifted the conversation with Schneier to talk about endpoint security, and asked him how vigilant he felt we are with the proliferation of devices.

“I worry less about computers and more about the cheaper devices – phones and the embedded devices, the Internet of Things. The endpoint security there is really terrible,” said Schneier.

For all the unknown devices that perpetuate our networks, Schneier pointed out two competing visions. The first is requiring minimum standards for devices on the Internet.

Any such requirements seem difficult if not impossible to enforce.

The other, which seems more plausible, said Schneier, is that the network needs to be smarter. The reality is there are always going to be unknown devices on every network. The goal is to get security in spite of that.

Related Posts

Subscribe to the Tenable Blog

Subscribe
Try for Free Buy Now

Try Tenable.io

FREE FOR 60 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now.

Buy Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

$2,275.00

Buy Now

Try for Free Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save

Try for Free Buy Now

Try Tenable.io Web Application Scanning

FREE FOR 60 DAYS

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578.00

Buy Now

Try for Free Contact Sales

Try Tenable.io Container Security

FREE FOR 60 DAYS

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Learn More about Industrial Security

Get a Demo of Tenable.sc

Please fill out the form below with your contact information and a sales representative will contact you shortly to schedule a demo. You may also include a short comment (limited to 255 characters). Please note that fields with asterisks (*) are mandatory.